The script contrib/hook-scripts/check-mime-type.pl does not escape
argv arguments to 'svnlook' that start with a hyphen. This could be
used to cause 'svnlook', and hence check-mime-type.pl, to error out.

The script contrib/hook-scripts/svn-keyword-check.pl parses filenames
from the output of 'svnlook changed' and passes them to a further
shell command (equivalent to the 'system()' call of the C standard
library) without escaping them. This could be used to run arbitrary
shell commands in the context of the user whom the pre-commit script
runs as (the user who owns the repository).

mod_dontdothat allows you to block update REPORT requests against certain
paths in the repository. It expects the paths in the REPORT request
to be absolute URLs. Serf based clients send relative URLs instead
of absolute URLs in many cases. As a result these clients are not blocked
as configured by mod_dontdothat.

When SVNAutoversioning is enabled via SVNAutoversioning on
commits can be made by single HTTP requests such as MKCOL and
PUT. If Subversion is built with assertions enabled any such
requests that have non-canonical URLs, such as URLs with a
trailing /, may trigger an assert. An assert will cause the
Apache process to abort.

svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack.

Subversion Project reports:

svnserve takes a --pid-file option which creates a file containing the
process id it is running as. It does not take steps to ensure that the file
it has been directed at is not a symlink. If the pid file is in a directory
writeable by unprivileged users, the destination could be replaced by a
symlink allowing for privilege escalation. svnserve does not create a pid
file by default.

All versions are only vulnerable when the --pid-file=ARG option is used.

Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion
on some requests made against a revision root. This can lead to a DoS.
If assertions are disabled it will trigger a read overflow which may cause a
SEGFAULT (or equivalent) or undefined behavior.